This update for libsodium fixes the following issues:
Update to 1.0.22 (jsc#PED-16890):
* Post-quantum key encapsulation is now available. ML-KEM768, the
NIST-standardized lattice-based KEM, is accessible through the
crypto_kem_mlkem768_*() functions.
* X-Wing, a hybrid KEM combining ML-KEM768 with X25519 for protection
against both classical and quantum adversaries, is available through the
crypto_kem_*() functions. X-Wing is the recommended KEM for most
applications.
* SHA-3 hash functions are now available as crypto_hash_sha3256_*()
and crypto_hash_sha3512_*(), with both one-shot and streaming APIs.
* Perf
This update for dnsdist fixes the following issues:
Update to version 1.9.12.
- https://www.dnsdist.org/changelog.html#change-1.9.12
Security issues fixed:
- CVE-2026-0396: crafted DNS queries triggering domain-based dynamic rules can lead to HTML injection in the web
dashboard (bsc#1261236).
- CVE-2026-0397: misconfiguration of the CORS policy can lead to information disclosure (bsc#1261237).
- CVE-2026-24028: crafted DNS packet parsed by Lua code using `newDNSPacketOverlay` can lead to an out-of-bounds read
(bsc#1261238).
- CVE-2026-24029: disabled option on a DNS over HTTPS nghttp2 frontend allows clients to bypass ACLs and send Do
This update for dnsdist fixes the following issues:
Update to dnsdist 1.9.11:
- CVE-2025-8671: Add mitigations for the HTTP/2 MadeYouReset attack (bsc#1253852).
- CVE-2025-30187: denial of service via crafted DoH exchange (bsc#1250054).
This update for dnsdist fixes the following issues:
Update to version 1.9.10.
- CVE-2025-30194: illegal memory access (double-free) when processing specially crafted DoH exchanges leads to a
denial-of-service (bsc#1242028).
- CVE-2025-30193: stack exhaustion when processing too many queries on incoming TCP connections leads to a
denial-of-service (bsc#1243378).